Google Git
Sign in
qemu / qemu / 8d1b247f3748ac4078524130c6d7ae42b6140aaf
commit8d1b247f3748ac4078524130c6d7ae42b6140aaf[log] [tgz]
authorStefano Garzarella <sgarzare@redhat.com>Mon Feb 28 10:50:58 2022 +0100
committerMichael S. Tsirkin <mst@redhat.com>Sun Mar 06 05:08:23 2022 -0500
tree8cf5d1d82e20ca7d479801b5e5d8e9baa9f24229
parent4ccd5fe22feb95137d325f422016a6473541fe9f [diff]
vhost-vsock: detach the virqueue element in case of error

In vhost_vsock_common_send_transport_reset(), if an element popped from
the virtqueue is invalid, we should call virtqueue_detach_element() to
detach it from the virtqueue before freeing its memory.

Fixes: fc0b9b0e1c ("vhost-vsock: add virtio sockets device")
Fixes: CVE-2022-26354
Cc: qemu-stable@nongnu.org
Reported-by: VictorV <vv474172261@gmail.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20220228095058.27899-1-sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
1 file changed
tree: 8cf5d1d82e20ca7d479801b5e5d8e9baa9f24229
  1. .github/
  2. .gitlab/
  3. .gitlab-ci.d/
  4. accel/
  5. audio/
  6. authz/
  7. backends/
  8. block/
  9. bsd-user/
  10. chardev/
  11. common-user/
  12. configs/
  13. contrib/
  14. crypto/
  15. disas/
  16. docs/
  17. dump/
  18. ebpf/
  19. fpu/
  20. fsdev/
  21. gdb-xml/
  22. hw/
  23. include/
  24. io/
  25. libdecnumber/
  26. linux-headers/
  27. linux-user/
  28. migration/
  29. monitor/
  30. nbd/
  31. net/
  32. pc-bios/
  33. plugins/
  34. po/
  35. python/
  36. qapi/
  37. qga/
  38. qobject/
  39. qom/
  40. replay/
  41. roms/
  42. scripts/
  43. scsi/
  44. semihosting/
  45. softmmu/
  46. storage-daemon/
  47. stubs/
  48. subprojects/
  49. target/
  50. tcg/
  51. tests/
  52. tools/
  53. trace/
  54. ui/
  55. util/
  56. capstone
  57. dtc
  58. meson
  59. slirp
  60. .cirrus.yml
  61. .dir-locals.el
  62. .editorconfig
  63. .exrc
  64. .gdbinit
  65. .gitattributes
  66. .gitignore
  67. .gitlab-ci.yml
  68. .gitmodules
  69. .gitpublish
  70. .mailmap
  71. .patchew.yml
  72. .readthedocs.yml
  73. .travis.yml
  74. block.c
  75. blockdev-nbd.c
  76. blockdev.c
  77. blockjob.c
  78. configure
  79. COPYING
  80. COPYING.LIB
  81. cpu.c
  82. cpus-common.c
  83. disas.c
  84. gdbstub.c
  85. gitdm.config
  86. hmp-commands-info.hx
  87. hmp-commands.hx
  88. iothread.c
  89. job-qmp.c
  90. job.c
  91. Kconfig
  92. Kconfig.host
  93. LICENSE
  94. MAINTAINERS
  95. Makefile
  96. memory_ldst.c.inc
  97. meson.build
  98. meson_options.txt
  99. module-common.c
  100. os-posix.c
  101. os-win32.c
  102. page-vary-common.c
  103. page-vary.c
  104. qemu-bridge-helper.c
  105. qemu-edid.c
  106. qemu-img-cmds.hx
  107. qemu-img.c
  108. qemu-io-cmds.c
  109. qemu-io.c
  110. qemu-keymap.c
  111. qemu-nbd.c
  112. qemu-options.hx
  113. qemu.nsi
  114. qemu.sasl
  115. README.rst
  116. replication.c
  117. trace-events
  118. VERSION
  119. version.rc